ledger-live-portfolios[.]com

PhishDestroy identifies ledger-live-portfolios.com as an active brand impersonation domain targeting Ledger users. This domain mimics the official Ledger Live portfolio interface to deceive victims into entering sensitive wallet credentials or transferring cryptocurrency to attacker-controlled addresses. The threat remains under investigation but exhibits clear malicious intent through its fraudulent branding and recent infrastructure setup. Immediate action is recommended to prevent potential financial losses or credential exposure.

This domain was flagged with a VirusTotal detection rate of 1 out of 95 engines, indicating it has not yet been widely recognized as malicious. It resolves to IP 104.21.41.199 and leverages a Google Trust Services SSL certificate to appear legitimate. Registered on February 12, 2026, through Hello Internet Corp, the domain is newly operational and has not yet appeared on major threat intelligence blocklists. While the certificate adds a veneer of authenticity, the combination of impersonation tactics, recent creation, and low detection rate suggests this is a high-risk threat in its early stages.

To mitigate exposure to this threat, SOC teams should immediately block the domain ledger-live-portfolios.com at the network and DNS levels. Users should be warned via internal advisories to verify any Ledger-related domains against official sources (e.g., ledger.com) before interacting with login portals or portfolio interfaces. Additionally, endpoint monitoring should be heightened for anomalous outbound connections to 104.21.41.199. Given the low VT detection, manual inspection of SSL certificates for Hello Internet Corp registrations from February 2026 onward is advised to preempt similar campaigns.